Glossary
The words in our reports, in plain language.
140 terms you will meet in proposals, reports and incident calls, from attestation letters to zero-days. Each one says what the term means, why it matters to your organisation and what to do about it, with links to the work that goes deeper.
A
- Account takeover
- An attacker gaining control of a real user's account through stolen or guessed credentials, a hijacked session or an abused password-reset flow. Because the attacker then looks like a legitimate user, most monitoring does not notice. Login, reset, MFA enrolment and session handling are where a test looks for it.
- Related
- Web application testing
- Active Directory
- Microsoft's directory service, holding the users, computers, groups and permissions of most Windows-based organisations. Whoever controls it controls almost everything joined to it, so internal tests usually ask whether an ordinary staff account can reach domain administrator.
- Related
- Network & infrastructure testing Network protocol field guides
- Agentic AI
- AI systems that act on a user's behalf: calling tools, reading inboxes, querying databases or changing records. Every permission the agent holds becomes reachable by anyone who can influence what it reads, so testing focuses on what it can be talked into doing. Give agents the narrowest permissions possible and require human confirmation for consequential actions.
- Related
- AI & LLM application testing
- API (application programming interface)
- The interface one piece of software uses to talk to another; most web and mobile products are a thin front end over APIs. APIs often expose more data and functions than the screens built on them, which is why authorisation flaws there are among the most serious findings in modern tests. Every endpoint should be in scope, including undocumented and older versions.
- Related
- Web application testing Mobile application testing
- Assumed breach
- A test that starts from the premise that an attacker is already inside, for example with a standard employee laptop and account, instead of spending time breaking through the perimeter. It answers the question boards ask: if someone gets in, how far can they go, and would we notice?
- Related
- Red team & purple team Network & infrastructure testing
- Attack path
- The chain of individually modest weaknesses an attacker links together to reach something valuable: a leaked token, then an over-permissive role, then a production database. Reporting the whole path shows which single fix breaks the chain. It is how several medium findings add up to a critical risk.
- Related
- Penetration testing Case studies
- Attack surface
- Everything an attacker can reach and try to abuse: websites, APIs, mobile apps, exposed servers, cloud accounts, third-party integrations and the people who answer email and phones. It grows quietly with every new feature, supplier and forgotten test environment. An accurate picture of it is the starting point for a meaningful scope.
- Related
- The pentest scoping call Website security audit
- Attestation letter
- A short, signed letter confirming that a penetration test took place, what was in scope, when it ran, the method used and the current status of findings, without technical detail. It lets you prove testing to customers, auditors and insurers without handing over the full report. Ours is issued after the retest, and anything not verified as fixed stays open in it.
- Related
- Penetration testing The pentest scoping call
B
- Black box testing
- Testing with no inside knowledge, no accounts and no documentation, starting where an anonymous outsider would. It is realistic for the perimeter but spends much of the time on discovery, so it finds fewer deep issues per day than grey or white box testing. Choose it when the question is specifically what an outsider can do.
- Related
- The pentest scoping call
- Blue team
- The people and tools that defend an organisation: security operations, detection engineers, incident responders and the IT staff who keep systems patched. In red team exercises they are the side being tested; in purple team work they sit with the attackers and improve detections as each technique runs. Their alerts and logs are what turn a test into measurable improvement.
- Related
- Red team & purple team
- BOLA (broken object level authorisation)
- The API-world name for IDOR: an endpoint returns or changes a record without checking that the caller may touch that specific record. It is the first entry in the OWASP API Security Top 10 because it is common, easy to exploit and often exposes other customers' data. Testing it needs at least two accounts per role, so one user's identifiers can be tried with another's session.
- Related
- Web application testing
- Bug bounty
- A standing programme that pays independent researchers for valid vulnerabilities they report under published rules. It adds many eyes over time but promises no coverage, depth or timing, so it complements a scoped penetration test and does not replace one. Launch one only when you can triage and fix reports quickly.
- Related
- Responsible disclosure
- Business email compromise
- Fraud in which an attacker uses a hijacked or convincingly spoofed email account to redirect payments, change supplier bank details or request sensitive data. It needs no malware and usually arrives as an ordinary-looking request at a busy moment. The defences are procedural as much as technical: confirm payment changes by phone on a known number, and protect mailboxes with phishing-resistant MFA.
- Related
- Social engineering assessment Incident response
- Business logic flaw
- A weakness in how an application's rules are implemented, such as applying a discount twice, skipping a payment step or approving your own request. Scanners cannot find these because every request looks valid; it takes a tester who understands what the feature is meant to do.
- Related
- Web application testing Application security audit
C
- Certificate pinning
- A technique in which a mobile or desktop app trusts only specific certificates or keys for its own servers, so its traffic cannot be intercepted with a rogue certificate. It raises the bar for anyone studying your API, but it is not a substitute for proper authorisation on the server. Mobile tests check how well it is implemented and what sits behind it.
- Related
- Mobile application testing
- Chain of custody
- The documented record of who collected each piece of evidence, when and how, where it has been stored and who has handled it since. Without it, logs and disk images carry far less weight with insurers, regulators or a court. Good incident response starts this record on the first call, before anyone reboots or rebuilds a machine.
- Related
- Incident response Incident checklists
- CIS Benchmarks
- Consensus-developed configuration guides from the Center for Internet Security for operating systems, cloud platforms, databases, browsers and network devices. Each recommendation explains the setting, why it matters and how to check it, which makes them the usual yardstick for configuration audits. A finding mapped to a benchmark item is easy to fix and easy to verify.
- Related
- Database security audit Cloud configuration review
- Command and control (C2)
- The channel an attacker uses to send instructions to compromised machines and receive data back, often disguised as ordinary web traffic. Finding and cutting it is a key part of containment. Red team exercises use controlled C2 to check whether your monitoring notices this kind of traffic.
- Related
- Red team & purple team Incident response
- Containment
- The incident response phase that stops an attack spreading while preserving evidence: isolating machines, disabling accounts, revoking tokens and blocking attacker infrastructure. Done too early or too loudly it can tip off the attacker; done too late it lets them reach backups or more data. It should follow a quick assessment of scope, not a rush to switch everything off.
- Related
- Incident response Incident checklists
- Credential stuffing
- Automated login attempts using username and password pairs leaked from other websites, relying on people reusing passwords. It produces account takeovers without any flaw in your own code. Rate limiting, checks against known breached passwords and MFA are the standard defences, and a test should confirm none of them can be bypassed.
- Related
- Web application testing
- CSP (Content Security Policy)
- A response header telling browsers which sources of scripts, styles and other content a page may load. A strict policy turns many cross-site scripting bugs from account takeover into a blocked request. Policies that allow 'unsafe-inline' or whole content networks often look present but protect little, which is what an audit checks.
- Related
- Website security audit
- CSRF (cross-site request forgery)
- An attack that makes a logged-in user's browser send a request they did not intend, such as changing their email address or approving a transfer, from another website. SameSite cookie settings and anti-CSRF tokens have made it rarer, but it still appears in older frameworks and custom authentication schemes. A test checks it on every action that changes state.
- Related
- Web application testing
- CVE (Common Vulnerabilities and Exposures)
- The public catalogue of disclosed vulnerabilities, in which each gets an identifier such as CVE-2021-44228, the Log4Shell flaw in Apache Log4j, so vendors, scanners and defenders can refer to the same issue. An identifier says a flaw exists; it does not say whether you are exposed or whether attackers are using it. Combine it with the Known Exploited Vulnerabilities catalogue and your own asset inventory to decide what comes first.
- Related
- Cyber news digest
- CVSS (Common Vulnerability Scoring System)
- A standard maintained by FIRST for scoring a vulnerability's technical severity from 0 to 10, based on factors such as how it is reached and what it affects. We score findings with CVSS 4.0 and then adjust for business context, because the same flaw matters more on a payments API than on a marketing page. Treat the number as an input to prioritisation, not the decision itself.
- Related
- Penetration testing
D
- DAST (dynamic application security testing)
- Automated testing that probes a running application from outside, sending crafted requests and reading the responses. It catches common, well-understood issues across many pages quickly, but it cannot reason about permissions or business rules. In our engagements it widens coverage; it is never the assessment itself.
- Related
- Application security audit Web application testing
- Data leak site
- A website run by an extortion group that names its victims and publishes stolen data when they do not pay. Listings are sometimes exaggerated or recycled from older breaches, so a mention is a reason to investigate, not proof of a new compromise. Watching them can be the first warning that a supplier has been hit.
- Related
- Incident response Cyber news digest
- Data poisoning
- Deliberately corrupting the data an AI system learns from or looks things up in, so that it gives wrong, biased or attacker-chosen answers. It applies to training data and also to the documents a retrieval-based assistant searches at question time, which are usually much easier to tamper with. Control who can write to those sources and keep a record of where data came from.
- Related
- AI & LLM application testing
- Data protection officer (DPO)
- The person who oversees how an organisation handles personal data and acts as the contact point for regulators and the public. The GDPR requires one for public authorities and for organisations whose core activities involve large-scale regular and systematic monitoring of people or large-scale processing of sensitive data. Israel's Amendment 13 added a comparable duty for public bodies, larger data brokers and organisations that monitor people or hold especially sensitive data at large scale.
- Related
- Compliance frameworks
- Deepfake
- Synthetic audio, video or images generated by AI to impersonate a real person convincingly. In attacks it appears as a cloned executive voice on a call or a fake video meeting requesting an urgent payment or a password reset. The defence is a process that never authorises money or access on the strength of a voice or a face alone.
- Related
- Social engineering assessment
- Dependency confusion
- A supply chain attack in which someone publishes a public package with the same name as one of your private, internal packages, hoping your build tools fetch theirs instead. If they do, the attacker's code runs inside your build system or your product. Scoped package names, pinned registries and lockfiles close the gap.
- Related
- Application security audit
- Digital forensics
- The careful collection and analysis of evidence from computers, phones, cloud logs and networks to establish what happened during an incident. It answers the questions insurers, regulators and boards will ask: how they got in, what they touched and whether data left. Evidence gathered before clean-up is far more conclusive than evidence gathered after.
- Related
- Incident response Breach archives
- DORA (Digital Operational Resilience Act)
- EU Regulation 2022/2554, applied since 17 January 2025, sets rules on ICT risk management, incident reporting and resilience testing for banks, insurers, investment firms and many other financial entities. Firms identified by their regulators must also run threat-led penetration testing at least every three years. It reaches the technology providers those firms depend on through mandatory contract terms and, for critical providers, direct oversight.
- Related
- Compliance frameworks Red team & purple team
- Double extortion
- A ransomware tactic in which attackers copy data before encrypting systems, then demand payment both to restore access and to keep what they took unpublished. Good backups alone therefore no longer end the incident. Response plans need to cover legal notification, communication and evidence of what was taken.
- Related
- Incident response Breach archives
- Dwell time
- The time between an attacker first getting in and the organisation noticing. The longer it runs, the more they can learn, steal and prepare, and the harder the investigation becomes. It can only be measured as far back as your logs go, so short log retention hides when an attacker first got in.
- Related
- Red team & purple team Incident response
E
- EDR (endpoint detection and response)
- Security software on laptops and servers that records process, file and network activity, flags suspicious behaviour and lets responders isolate a machine remotely. In an incident it is usually the richest source of evidence, provided it was deployed everywhere and its data was retained. Tests often check whether common attacker techniques run beneath it unnoticed.
- Related
- Incident response Red team & purple team
- Encryption at rest
- Encrypting stored data on disks, databases, snapshots and backups, so a stolen drive or copied snapshot is unreadable without the keys. It does not stop an attacker who logs in through the application, because the application decrypts data for them. Who can reach the keys matters as much as the encryption itself.
- Related
- Database security audit Cloud configuration review
- Eradication
- The incident response phase that removes the attacker completely: deleting web shells and implants, closing the original way in, resetting compromised credentials and fixing the weaknesses they used. Skipping any of these is how the same attacker returns weeks later. It should begin only once the full extent of the intrusion is understood.
- Related
- Incident response
- Exfiltration
- The unauthorised copying of data out of an organisation, whether to an attacker's server, a cloud storage account or a personal mailbox. Whether it happened, and what was taken, usually decides your legal notification duties. Network logs, cloud audit trails and endpoint telemetry are the evidence that answers it.
- Related
- Incident response Red team & purple team
- Exploit
- Code or a sequence of steps that takes advantage of a vulnerability to make a system do something it should not. In a penetration test, a safe and controlled exploit is the proof that a finding is real, not theoretical. Which techniques are allowed, and when, is agreed in the rules of engagement before testing starts, so anything that could disrupt a live system runs only with your sign-off, in a window you have approved.
- Related
- Penetration testing
F
- False positive
- A reported vulnerability that turns out not to exist, typical of unverified scanner output. Each one wastes engineering time and erodes trust in the rest of the report. We only report findings we have reproduced, with the evidence to show it.
- Related
- Penetration testing
- Finding
- A single confirmed security issue in a report, with what it is, where it is, how to reproduce it, the evidence, its severity and how to fix it. A good finding can be handed to an engineer who was not involved in the test and fixed without a follow-up meeting. Findings are the unit you track through remediation and retest.
- Related
- Penetration testing How we work
- Forensic image
- An exact, verified copy of a disk, memory or cloud volume, made so it can be analysed without altering the original. A cryptographic hash recorded when it is taken proves the copy has not changed since. Take images before rebuilding affected systems, or the evidence is gone.
- Related
- Incident response Incident checklists
G
- GDPR (General Data Protection Regulation)
- The EU's data protection law, Regulation 2016/679, which applies to organisations in the EU and to those elsewhere that offer goods or services to people in the EU or monitor their behaviour. Article 32 requires security appropriate to the risk, including a process for regularly testing its effectiveness, and Article 33 requires a personal data breach to be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people's rights and freedoms at risk. Penetration tests and rehearsed incident response are common ways to evidence both.
- Related
- Compliance frameworks Our privacy policy
- Grey box testing
- Testing with partial inside knowledge, typically accounts for each user role and some documentation, but not the full source code. It is the usual choice for web and API tests because the time goes on what logged-in users and attackers holding stolen accounts can do, not on discovery.
- Related
- The pentest scoping call Web application testing
H
- Hardening
- Reducing what a system exposes by removing what it does not need and tightening what it keeps: disabling unused services, closing ports, enforcing secure settings and removing default accounts. Published baselines such as the CIS Benchmarks give a checklist per product. Hardening removes whole classes of finding at once.
- Related
- Database security audit Website security audit
- Honeypot
- A decoy system, account, credential or form field that no legitimate user should ever touch, so any interaction with it is a strong sign of an attacker or a bot. A fake cloud access key left in a file share or code repository, set to raise an alarm the moment anyone tries it, is one example. Our own contact form uses a hidden honeypot field to filter out automated spam.
- Related
- Incident response
- HSTS (HTTP Strict Transport Security)
- A response header that tells browsers to connect to your site only over HTTPS for a set period, even when someone types or follows a plain HTTP link. It closes the window in which an attacker on the same network could downgrade or intercept that first connection. A website audit checks that it is present, long-lived and applied to subdomains where appropriate.
- Related
- Website security audit
I
- IAM (identity and access management)
- The policies and tools that decide who and what can perform which actions on which resources, especially in cloud platforms such as AWS, Azure and Google Cloud. Overly broad roles are a common route from one compromised workload or laptop to an entire cloud account. A cloud review maps those routes and narrows the permissions along them.
- Related
- Cloud configuration review
- IDOR (insecure direct object reference)
- A flaw where changing an identifier in a request, such as an invoice number or a user ID, returns or alters someone else's data because the server never checks ownership. In multi-tenant software it can expose one customer's data to another. Random, hard-to-guess IDs only make it slower to find; the fix is an ownership check on the server for every request.
- Related
- Web application testing
- Immutable backup
- A backup that cannot be changed or deleted for a set period, even by an administrator account, using features such as object lock or write-once storage. An attacker who takes over your admin accounts still cannot destroy your way back. Test a full restore on a schedule and time it, because that figure is the least time a real recovery would take.
- Related
- Incident response Database security audit
- Incident response plan
- The written, agreed procedure for a suspected incident: who decides, who is called, how evidence is preserved and when regulators, customers and insurers are told. A plan that has never been rehearsed usually fails at the first unexpected question. Keep it short, keep its contact details current and test it with a tabletop exercise.
- Related
- Incident response Incident checklists
- Incident response retainer
- An agreement made in advance with a response team, so contracts, contacts and access are settled before anything goes wrong. When an incident starts, work begins at once instead of after days of procurement and onboarding. Retainers often include readiness work such as tabletop exercises and plan reviews.
- Related
- Incident response
- Indicator of compromise (IoC)
- A piece of technical evidence that suggests an intrusion, such as a malicious file hash, an attacker's IP address or domain, or an unexpected scheduled task. Sharing and searching for indicators lets other organisations check whether the same attacker has reached them. They go stale quickly, so detection based on behaviour should back them up.
- Related
- Incident response Breach archives
- Infostealer
- Malware that harvests saved passwords, browser cookies and session tokens from an infected computer and sends them to criminals, who sell them in bulk. Stolen session cookies can let an attacker skip both the password and MFA. Keeping work accounts off unmanaged personal devices and shortening session lifetimes reduce the exposure.
- Related
- Incident response Cyber news digest
- Initial access broker
- A criminal who breaks into organisations, or buys stolen logins, and sells that foothold to other groups such as ransomware operators. The person who got in and the person who later extorts you are often different, with days or weeks between them. Detecting the first, quieter stage is your best chance to stop the second.
- Related
- Incident response Cyber news digest
- Insecure deserialisation
- A flaw where an application rebuilds objects from data an attacker controls, such as a cookie or an API payload, without handling it safely. In many languages this can be turned into running the attacker's code on your server. The fix is to avoid native serialisation formats for untrusted input and to validate data before it is used.
- Related
- Web application testing Application security audit
- Instance metadata service
- A local endpoint inside cloud virtual machines that gives the machine its configuration and temporary credentials for its cloud role. An SSRF flaw that can reach it may leak those credentials and hand an attacker the server's cloud permissions. On AWS, requiring IMDSv2, which needs a session token, blocks most of these attacks.
- Related
- Cloud configuration review
- ISO/IEC 27001
- The international standard for an information security management system: how an organisation identifies risks, chooses controls and keeps improving them, with certification by an accredited body. The 2022 edition lists 93 reference controls in Annex A, among them management of technical vulnerabilities and security testing during development. Penetration test reports are common evidence for both.
- Related
- Compliance frameworks
J
- Jailbreak
- A prompt crafted to make an AI model ignore its safety rules or its operator's instructions, often through role-play or by burying the request in a long, confusing context. The business risk is an assistant that reveals its hidden instructions or internal data, or says things you would never approve. On phones the same word means removing the operating system's restrictions, which apps handling payments often try to detect.
- Related
- AI & LLM application testing Mobile application testing
- JWT (JSON Web Token)
- A compact, signed token that many applications use to prove who a user is on each request. Common mistakes include accepting unsigned tokens, weak signing keys, tokens that never expire and trusting claims the client can change. Each can let an attacker impersonate another user, so they are standard checks in a web or API test.
- Related
- Web application testing
K
- Kerberoasting
- An Active Directory attack in which any ordinary domain user requests encrypted service tickets for accounts that run services, then cracks their passwords offline without triggering lockouts. Service accounts with weak, old passwords and high privileges make it a common step towards domain administrator. Long random passwords or group managed service accounts close it.
- Related
- Network & infrastructure testing
- Known Exploited Vulnerabilities catalogue (KEV)
- A list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with reliable evidence of active exploitation. US federal civilian agencies must fix listed issues by set deadlines under Binding Operational Directive 22-01, and many private organisations use it to decide what to patch first. If something you run appears on it, treat it as urgent whatever its CVSS score.
- Related
- Cyber news digest
L
- Lateral movement
- How an attacker spreads from the first machine they compromise to others, using stolen credentials, remote management tools or trust between systems. It is the stage that turns one infected laptop into an organisation-wide incident. Segmentation, unique local administrator passwords and good monitoring make it slow and noisy.
- Related
- Network & infrastructure testing Breach archives
- Least privilege
- The principle that every person, service and machine gets only the access its job needs, and only for as long as it needs it. It limits the damage any single stolen account or compromised system can do. Many cloud and Active Directory findings come down to it not being applied.
- Related
- Cloud configuration review Network & infrastructure testing
M
- MFA (multi-factor authentication)
- Signing in with something beyond a password, such as a code from an app, a push notification or a hardware key. It stops most password-only attacks, but codes and push approvals can still be phished or pestered into approval. Cover every login path, including legacy protocols and account recovery, or attackers use the one without it.
- Related
- Web application testing Social engineering assessment
- Misconfiguration
- A security weakness created by settings rather than code, such as a public storage bucket, a database open to the internet, default credentials or overly broad permissions. In cloud environments a single changed setting can expose data to the whole internet. Configuration reviews against a benchmark catch these systematically.
- Related
- Cloud configuration review Database security audit
- MITRE ATLAS
- MITRE's knowledge base of the tactics and techniques used against AI-enabled systems, modelled on ATT&CK and built from real attacks and research. It adds techniques specific to AI systems, such as prompt injection, training data poisoning and model theft. Findings from our AI and LLM testing cite its techniques alongside the OWASP Top 10 for LLM Applications 2026.
- Related
- AI & LLM application testing
- MITRE ATT&CK
- A free, public knowledge base maintained by MITRE of the tactics and techniques real attackers use, from initial access to exfiltration. It gives attacker behaviour a shared vocabulary, so a finding or a detection gap can be tied to a specific technique. We map red team activity and incident timelines to it so defenders can see where detection fell short.
- Related
- Breach archives Red team & purple team
- Model Context Protocol (MCP)
- An open protocol, introduced by Anthropic in November 2024, that lets AI assistants connect to external tools and data through standard servers. Each connected server extends what an assistant can read and do, so a malicious or over-permissive server, or poisoned content it returns, becomes a path to your data. Review MCP servers like any third-party integration: who wrote it, what it can reach and what it can change.
- Related
- AI & LLM application testing
N
- Network segmentation
- Dividing a network into zones, such as office, production, payments and guest, with controlled paths between them. It limits how far an attacker can move after one compromise and can narrow the scope of standards such as PCI DSS. Segmentation is only as good as its testing, so a test confirms that the paths you believe are closed really are.
- Related
- Network & infrastructure testing Network protocol field guides
- NIS2
- The EU's Directive 2022/2555 on network and information security, which member states had to turn into national law by 17 October 2024. It covers medium-sized and large organisations in a long list of critical sectors, makes management accountable for cyber risk and requires significant incidents to be reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month of that notification. Testing, audits and rehearsed response help evidence the measures it requires.
- Related
- Compliance frameworks
- NIST SP 800-115
- The US National Institute of Standards and Technology's Technical Guide to Information Security Testing and Assessment, published in 2008. It sets out how to plan, run and report security tests, from document and log reviews to penetration testing, including how to handle the sensitive data testing produces. Its method still frames many testing programmes, even where its tool references have aged.
- Related
- How we work Network & infrastructure testing
- NIST SP 800-61
- NIST's guidance on incident response. Revision 3, published in April 2025, replaced the 2012 edition and treats incident response as part of overall cyber risk management, organised around the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. It is a sound reference for structuring an incident response plan.
- Related
- Incident response
- NTLM relay
- An attack on Windows networks in which an attacker intercepts a machine's or user's login attempt and forwards it to another server to authenticate as them. It works wherever protections such as SMB signing and LDAP signing are not enforced, and in internal tests it is a well-trodden route to domain compromise. Enforcing signing and phasing out NTLM close most paths.
- Related
- Network & infrastructure testing Network protocol field guides
O
- OAuth
- A standard that lets one application act on a user's behalf in another without seeing their password; it is the mechanism behind 'allow this app to access your account' screens. Mistakes in redirect handling, token storage or scope checks can hand access tokens to an attacker. Review third-party OAuth grants too, because a malicious app with broad permissions is a quiet form of account takeover.
- Related
- Web application testing
- Object storage bucket
- A cloud container for files, such as an Amazon S3 bucket, an Azure Blob Storage container or a Google Cloud Storage bucket. Buckets made public by mistake, or readable by any authenticated cloud user, remain a well-documented source of data leaks. Block public access at the account level and review every exception individually.
- Related
- Cloud configuration review
- OIDC (OpenID Connect)
- An identity layer on top of OAuth 2.0 that lets an application confirm who a user is through a trusted provider such as Google, Microsoft Entra ID or Okta, behind 'sign in with' buttons. Implementation mistakes, such as not validating a token's audience or signature, can let an attacker sign in as someone else. A test covers both the sign-in flow and how the application links identities to accounts.
- Related
- Web application testing
- OWASP ASVS
- The OWASP Application Security Verification Standard: a detailed catalogue of security requirements for web applications, organised by area and by level of assurance. We test and audit against version 5.0, and it doubles as a checklist your engineers can build to. Asking a supplier which ASVS level they test to is a quick way to compare proposals.
- Related
- Application security audit How we work
- OWASP Top 10
- A widely used awareness list, published by the Open Worldwide Application Security Project, of the most critical categories of web application security risk, such as broken access control and injection. It is a sensible minimum for training and procurement questions, but it is not a testing method. For that, OWASP's own verification standard and testing guide go much further.
- Related
- Web application testing Secure development training
- OWASP Web Security Testing Guide (WSTG)
- OWASP's catalogue of test cases for web applications, grouped by area such as configuration, authentication, authorisation, session management, input validation and business logic. Each test has an identifier, so a report can show precisely what was examined. It pairs with OWASP ASVS: the guide says how to test, the standard says what good looks like.
- Related
- Web application testing How we work
P
- Passkey
- A replacement for passwords built on the FIDO2 and WebAuthn standards: your device holds a private key and proves your identity to a website without sending any secret that could be stolen or phished. Passkeys can sync across a person's devices or live on a hardware security key. For staff and customer accounts they remove both password reuse and most phishing.
- Related
- Web application testing
- Password spraying
- Trying a few common passwords, such as a season and a year, against many accounts at once while staying below lockout limits. It works wherever some users have weak passwords and a login lacks MFA, which makes VPNs, email and cloud portals favourite targets. Banned-password lists, MFA and alerts on failed logins spread across many accounts defeat it.
- Related
- Network & infrastructure testing
- Patch management
- The process of finding, testing and applying software updates across everything you run, from laptops and firewalls to the libraries inside your own code. Attackers move quickly once a flaw in internet-facing software is published, so the process needs a fast lane for exposed systems and anything on the Known Exploited Vulnerabilities catalogue. An accurate asset inventory is what makes it work.
- Related
- Network & infrastructure testing Cyber news digest
- PCI DSS
- The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council for any organisation that stores, processes or transmits card data. Version 4.0.1 requires internal and external penetration tests at least once every 12 months and after significant changes, tests of any segmentation used to reduce scope, and, in requirements 6.4.3 and 11.6.1, controls over the scripts that run on payment pages. Reducing the number of systems that touch card data is the most effective way to shrink the testing burden.
- Related
- Compliance frameworks Website security audit
- Penetration test
- An authorised, simulated attack on a defined set of systems that proves which weaknesses can be exploited and how far each one leads. Unlike a scan, it chains weaknesses together, removes false positives and explains real-world impact. A good one ends with a report your engineers can act on, support while fixes are built and a retest that proves them.
- Related
- Penetration testing The pentest scoping call
- Phishing
- Messages, usually email, designed to trick someone into clicking a link, opening a file, entering credentials or approving a login. It remains one of the most common ways attackers gain their first foothold. Simulations measure how people and your reporting process respond, and the strongest technical answer is phishing-resistant MFA.
- Related
- Social engineering assessment
- Phishing-resistant MFA
- Multi-factor authentication that cannot be relayed through a fake login page, typically passkeys or hardware security keys based on the FIDO2 and WebAuthn standards. The browser ties each login to the real website's address, so a look-alike site receives nothing it can use. It is the single control that does most to blunt credential phishing.
- Related
- Social engineering assessment Web application testing
- Privacy Protection (Data Security) Regulations
- Israel's binding rules for securing databases of personal information, in force since May 2018, with duties that scale with a database's security level. At the high level the controller must run penetration tests and a risk assessment at least once every 18 months, and medium and high level databases need an audit at least once every 24 months. A severe security incident must be reported to the regulator immediately.
- Related
- Compliance frameworks Database security audit
- Privacy Protection Law Amendment 13
- The overhaul of Israel's Privacy Protection Law, 5741-1981, approved by the Knesset in August 2024 and in force since 14 August 2025. It requires some organisations to appoint a data protection officer, gives the Privacy Protection Authority powers to run criminal investigations and impose monetary sanctions, and widens the grounds for statutory damages without proof of harm. Organisations holding personal data in Israel should review their data inventory, security procedures and breach response against it.
- Related
- Compliance frameworks Our privacy policy
- Privilege escalation
- Gaining more access than you were given, either upwards, from a normal user to an administrator, or sideways, into another user's data at the same level. Almost every serious attack chain contains at least one escalation step. A report should show the exact path so it can be closed, not just the starting weakness.
- Related
- Network & infrastructure testing Cloud configuration review
- Prompt injection
- Instructions hidden in content an AI system reads, such as a web page, email, document or tool result, that override what its operator told it to do. Because today's models cannot reliably separate data from instructions, any assistant that reads untrusted content and can take actions is exposed. It is the first entry in the OWASP Top 10 for LLM Applications, and the dependable defence is limiting what the model can do, not hoping it refuses.
- Related
- AI & LLM application testing
- Proof of concept
- A minimal, safe demonstration that a vulnerability is real, such as reading a single record you should not see, never the whole table. It gives engineers something to reproduce and to verify their fix against. Ours stay non-destructive and inside the agreed rules of engagement.
- Related
- Penetration testing
- PTES (Penetration Testing Execution Standard)
- A community standard describing a penetration test from start to finish in seven sections: pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. It is less a checklist than a shared shape for an engagement, which makes proposals easier to compare. Our own engagement structure follows the same arc.
- Related
- How we work The pentest scoping call
- Purple team
- A collaborative exercise in which attackers and defenders work side by side, replaying techniques one at a time while the blue team checks what its tools saw and tunes detections on the spot. It turns red team findings into better monitoring during the exercise itself, not in a report that waits in a queue. It suits teams that have detection tooling but are unsure it works.
- Related
- Red team & purple team
R
- Race condition
- A flaw that appears when an application handles several near-simultaneous requests and checks something before acting on it, letting an attacker slip in between the check and the action. Typical results are redeeming a voucher many times, overdrawing a balance or getting past a rate limit. Finding them takes deliberately parallel requests, which automated scanners rarely send.
- Related
- Web application testing Application security audit
- Ransomware
- Malicious software that encrypts an organisation's files and systems so they cannot be used, followed by a demand for payment. Campaigns now commonly steal data first, which turns recovery into a data breach as well as an outage. Offline or immutable backups, rehearsed recovery and early detection of the intrusion that precedes encryption limit the damage.
- Related
- Incident response Breach archives
- Reconnaissance
- The information-gathering stage of an attack or a test: discovering domains, exposed services, technologies, staff names and leaked credentials from public sources. What turns up here often includes forgotten systems that were never in anyone's inventory.
- Related
- The pentest scoping call Tooling arsenal
- Red team
- An objective-based exercise in which a small team emulates a real adversary, often over several weeks, to reach a defined goal such as payment systems or customer data without being caught. Where a penetration test tries to find as many weaknesses as possible, a red team tests whether your people, processes and detection notice and respond. Commission one after penetration tests have found the obvious weaknesses and you have fixed them, or the exercise spends its weeks rediscovering them.
- Related
- Red team & purple team
- Remediation
- Fixing what a test found, whether by changing code, configuration or process, or by adding a compensating control while a deeper fix is built. A useful report ranks remediation by risk and effort, so engineers start with the changes that close the most dangerous paths. A retest then confirms each fix works.
- Related
- Penetration testing
- Remote code execution (RCE)
- A vulnerability that lets an attacker run their own commands on your server or device over a network, usually the most severe class of finding. From there they can read data, plant persistence and move to other systems. Internet-facing RCE flaws are the ones attackers race to exploit once a vendor publishes a fix.
- Related
- Penetration testing Cyber news digest
- Responsible disclosure
- Reporting a vulnerability privately to the organisation or vendor that can fix it, and allowing reasonable time before any public detail is shared; also called coordinated disclosure. It protects users while the fix is built. A published policy and a security.txt file make it easy for researchers to report issues to you rather than about you.
- Related
- Responsible disclosure
- Retest
- A follow-up test confirming that reported findings have been fixed properly and that the fixes have not opened anything new. Its results update each finding's status in the report and underpin any attestation letter. Ours is a free retest of every fixed finding within 30 days of report delivery, included in the engagement.
- Related
- Penetration testing The pentest scoping call
- Rules of engagement
- The signed document that authorises a test and sets its limits: in-scope targets, testing windows, permitted and forbidden techniques, escalation contacts and how our traffic can be identified. It protects both sides and is what makes testing lawful. Nothing starts until it is agreed.
- Related
- Responsible disclosure The pentest scoping call
S
- SAML
- Security Assertion Markup Language, an older but widespread XML-based standard for single sign-on, common in enterprise software. Mistakes in how applications validate SAML signatures have repeatedly let attackers forge a login as any user. If you sell to enterprises, expect your SAML integration to be tested.
- Related
- Web application testing
- SAST (static application security testing)
- Automated analysis of source code for insecure patterns, such as user input reaching a database query, without running the application. It is fast and fits into pull requests, but it raises false positives and misses flaws that depend on runtime behaviour or business rules. Treat its output as leads for review, not a verdict.
- Related
- Application security audit
- SBOM (software bill of materials)
- A machine-readable inventory of every component and library inside a piece of software, with versions, usually in the SPDX or CycloneDX format. When a new vulnerability is announced, it lets you search for the affected library and version across everything you ship instead of asking every team. The EU Cyber Resilience Act requires manufacturers of products with digital elements made available on the EU market to draw one up, an obligation that applies from 11 December 2027.
- Related
- Application security audit Compliance frameworks
- SCA (software composition analysis)
- Tooling that inventories the open-source libraries your software depends on and flags known vulnerabilities and licence problems in them. Third-party code often makes up much of an application, so this is where many known issues hide. Good tools also show whether the vulnerable function is reachable from your code, which keeps alerts manageable.
- Related
- Application security audit
- SCIM
- System for Cross-domain Identity Management, a standard that lets an identity provider create, update and remove user accounts in other applications automatically. It is what makes removing a leaver from every system at once achievable. Flawed SCIM endpoints can let a tenant administrator, or anyone holding a leaked token, create or modify accounts they should not.
- Related
- Web application testing
- Scope
- The exact definition of what a test covers and what it does not: applications, environments, IP ranges, user roles, techniques and time. A tight, honest scope is the biggest factor in whether a test answers your real question, and anything not written into it is out of bounds. Ours is agreed on the scoping call and confirmed in writing before testing starts.
- Related
- The pentest scoping call
- Secrets management
- Storing and distributing passwords, API keys and certificates through a dedicated vault, never in code, configuration files or chat messages. Secrets leaked in repositories and build logs are a routine way into cloud accounts. Scan commits for secrets, and rotate anything that has ever been exposed.
- Related
- Cloud configuration review Application security audit
- Security operations centre (SOC)
- The team, in-house or outsourced, that monitors an organisation's alerts and responds to suspected incidents, often around the clock. It is not the same thing as SOC 2, which is an audit report. If it is outsourced, confirm in the contract whether it can isolate a machine and disable an account itself, or only notify you.
- Related
- Red team & purple team
- Session hijacking
- Taking over a user's signed-in session by stealing or predicting the token that identifies it, through cross-site scripting, malware that steals browser cookies or tokens leaked in logs. It bypasses passwords and MFA entirely, because the login has already happened. Short session lifetimes, binding sessions to devices and revoking them on suspicious activity limit the impact.
- Related
- Web application testing
- Severity
- How serious a finding is, usually expressed as critical, high, medium, low or informational. We start from a CVSS score, adjust it for business context such as what data is reachable and how exposed the system is, and explain the reasoning in each finding. Severity sets the order of remediation, and critical issues are reported the moment they are confirmed, not saved for the report.
- Related
- Penetration testing How we work
- Shadow IT
- Systems, cloud accounts and software in use without the security team's knowledge, such as a campaign site on a separate host or a forgotten test environment. Because nobody patches or monitors them, they make attractive first footholds. External reconnaissance during a test regularly turns them up.
- Related
- Website security audit
- SIEM (security information and event management)
- A platform that collects logs from across an organisation, correlates them and raises alerts for analysts to investigate. It is only as good as the logs feeding it and the detection rules written for it. List the sources that actually reach it, because a detection rule for a log that is not connected never fires.
- Related
- Red team & purple team Incident response
- Smishing
- Phishing by text message, often posing as a delivery company, a bank or the recipient's own IT team, with a link to a fake login page. Phones show less of a web address, which makes these pages harder to spot. Include it in awareness training and protect logins with phishing-resistant MFA.
- Related
- Social engineering assessment
- SOAR (security orchestration, automation and response)
- Software that automates routine security tasks, such as enriching an alert, isolating a machine or disabling an account, following playbooks your team defines. It runs those steps as soon as an alert fires instead of waiting for an analyst, provided the playbooks have been tested. Badly tuned automation can also disrupt the business, so treat changes to it like any other production change.
- Related
- Incident response
- SOC 2
- An attestation report, produced by an independent auditor under AICPA standards, on how a service organisation's controls meet the Trust Services Criteria: security, plus availability, processing integrity, confidentiality and privacy where chosen. A Type I report assesses control design at a point in time; a Type II report tests whether controls operated effectively over a period. Enterprise customers often ask for one, and penetration tests are common supporting evidence.
- Related
- Compliance frameworks
- SQL injection
- A flaw where text from a user is inserted into a database query in a way that lets them change the query itself, potentially reading, altering or deleting the whole database. It has been understood for decades and is entirely preventable with parameterised queries, yet it still appears, especially in older code and hand-built reporting features. A test checks every input that reaches a database, including sort orders, filters and export features.
- Related
- Web application testing Database security audit
- SSO (single sign-on)
- Signing in once with a central identity provider, such as Microsoft Entra ID, Okta or Google Workspace, to reach many applications. It centralises controls like MFA and makes removing leavers fast, but it also makes the identity provider the most valuable account in the company. Protect administrator access to it accordingly.
- Related
- Web application testing
- SSRF (server-side request forgery)
- A flaw that lets an attacker make your server send requests on their behalf, typically through a feature that fetches a URL, such as a webhook, a link preview or an image import. Because the request comes from inside your network, it can reach internal services and cloud metadata endpoints that are invisible from the internet. In cloud environments it is a common route to stolen credentials.
- Related
- Web application testing Cloud configuration review
- STRIDE
- A threat modelling method developed at Microsoft that asks six questions of each part of a system: could someone spoof an identity, tamper with data, repudiate an action they took, disclose information, deny service to others or gain privileges they should not have? It gives engineers a structured way to find design weaknesses before code is written. It is one of the methods we use when threat modelling a new feature with your team.
- Related
- Threat modelling
- Supply chain attack
- An attack that reaches you through something you trust: a software library, a build tool, an update mechanism or a service provider with access to your systems. One compromised supplier can affect many of its customers at once. Inventory your dependencies and suppliers, limit what they can reach, and plan how you would respond if one were breached.
- Related
- Application security audit Breach archives
T
- Tabletop exercise
- A guided discussion in which leadership and technical teams walk through a realistic incident, such as ransomware discovered on a Friday night, step by step. It exposes missing decisions, contacts and permissions while the stakes are still imaginary. Run it with the people who would make the decisions on the night, and give each gap it exposes an owner and a date.
- Related
- Incident response Incident checklists
- Threat intelligence
- Evidence-based information about attackers, their targets, tools and techniques, used to decide what to defend first. Useful intelligence is specific to your sector, technology and region and leads to an action, such as a new detection rule or an urgent patch. Generic feeds without that context mostly add noise.
- Related
- Cyber news digest Breach archives
- Threat model
- A structured look at a system that asks what you are building, what can go wrong, what you will do about it and whether you did a good enough job. Done early, it finds design flaws that are costly to fix after release, and it points testing at the parts that matter.
- Related
- Threat modelling The pentest scoping call
- Threat-led penetration testing (TLPT)
- An intelligence-led red team exercise against an organisation's live critical functions, using attack scenarios built from the threats it faces. DORA requires it at least every three years for financial entities their regulators identify, and its technical standards draw on the TIBER-EU framework. It goes beyond a standard penetration test because it tests detection and response as well as defences.
- Related
- Red team & purple team Compliance frameworks
- TIBER-EU
- The European framework for threat intelligence-based ethical red teaming, published by the European Central Bank. It pairs a threat intelligence phase, which builds realistic attack scenarios for the specific organisation, with a red team phase that carries them out against live production systems under the oversight of the authorities. Many financial regulators use it, and DORA's threat-led testing standards build on it.
- Related
- Red team & purple team Compliance frameworks
- TLS (Transport Layer Security)
- The encryption protocol behind HTTPS that protects data travelling between browsers, apps and servers. Versions 1.2 and 1.3 are the ones to allow, since 1.0 and 1.1 were formally deprecated in 2021, and certificate or configuration mistakes can still weaken a modern setup. A website audit checks protocol versions, cipher suites, certificates and related headers such as HSTS.
- Related
- Website security audit Network protocol field guides
- Typosquatting
- Registering names that look like real ones, such as a package called 'reqeusts' or a domain one letter away from yours, to catch people who mistype. In software it slips malicious code into builds; in email and on the web it powers convincing phishing. Lockfiles, dependency review and monitoring for look-alike domains reduce the risk.
- Related
- Application security audit
V
- Vishing
- Voice phishing: phone calls or voice messages in which an attacker poses as IT support, a bank, a supplier or an executive to extract credentials, MFA codes or payments. Help desks are a prime target because their job is to be helpful. Strict identity checks before any password or MFA reset are the key control.
- Related
- Social engineering assessment
- Vulnerability scan
- An automated check that compares your systems against a database of known vulnerabilities and misconfigurations. It is worth running continuously, but it cannot chain issues, judge business impact or find logic flaws, and it reports false positives. In a penetration test its output is a list of leads that testers confirm, discard or chain.
- Related
- Penetration testing
W
- WAF (web application firewall)
- A filter in front of a website or API that blocks requests matching known attack patterns, often provided by a content delivery network or cloud platform. It buys time against mass exploitation but can usually be bypassed by a determined attacker, so it should never be the only fix. Before a test we agree whether to test through it, around it or both.
- Related
- Website security audit
- Web shell
- A small malicious script an attacker plants on a web server so they can run commands through ordinary-looking web requests. It gives persistent access that survives password resets, which is why finding and removing every one is part of eradication. File integrity monitoring on web directories and endpoint detection on servers help catch them.
- Related
- Incident response
- White box testing
- Testing with full inside knowledge: source code, architecture diagrams, configuration and access to the engineers who built the system. It finds the most issues per day, including ones that are almost impossible to reach from outside, and gives the most precise fix guidance. It suits audits of critical code such as authentication, payments and tenant isolation.
- Related
- Application security audit The pentest scoping call
- Workload identity
- The identity that software such as a container, a serverless function or a CI pipeline uses to call cloud services, ideally short-lived credentials issued automatically, not keys stored in files. Done well, it removes long-lived secrets from code and configuration. Done badly, it lets anything running on a node borrow the permissions of everything else there.
- Related
- Cloud configuration review
X
- XSS (cross-site scripting)
- A flaw that lets an attacker run their own script in another user's browser on your site, for example by planting it in a comment or a crafted link. The script acts as that user, so it can read their data, change their settings or steal their session. Output encoding, safe framework defaults and a strict Content Security Policy prevent it.
- Related
- Web application testing Website security audit
Z
- Zero trust
- A security approach that drops the idea of a trusted internal network and verifies every user, device and request every time, based on identity and context. In practice it means strong authentication everywhere, least-privilege access to individual applications and continuous monitoring, as described in NIST SP 800-207. It is a direction of travel, not a product you can buy.
- Related
- Network & infrastructure testing Cloud configuration review
- Zero-day
- A vulnerability that attackers know about and can exploit before the vendor has released a fix, leaving defenders zero days of warning. You cannot patch it, so what matters is limiting exposure, watching for exploitation and acting quickly when a fix arrives. Internet-facing appliances such as VPNs and firewalls have been frequent targets.
- Related
- Cyber news digest Incident response
Which of these would a test of your systems cover?
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email. It lists every target and what stays out of scope.